
class JSON_KEY:

    '''记录json数据检索的关键字段

    使用这些类变量名，方便数据解析工作的进行。

    '''

    #
    # 对于 Event 记录来说
    #

    F_EVENT = 'com.bbn.tc.schema.avro.cdm18.Event'

    # 提取事件相关信息所需检索字段(json键字符串)
    F_EVENT_UUID = 'uuid'
    F_EVENT_SEQUENCE = 'sequence'
    F_EVENT_SEQUENCE_LONG = 'long'
    F_EVENT_TYPE = 'type'
    F_EVENT_THREAD_ID = 'threadId'
    F_EVENT_THREAD_ID_INT = 'int'
    F_EVENT_HOST_ID = 'hostId'
    F_EVENT_SUBJECT = 'subject'
    F_EVENT_SUBJECT_UUID = 'com.bbn.tc.schema.avro.cdm18.UUID'
    F_EVENT_PREDICATE_OBJECT = 'predicateObject'
    F_EVENT_PREDICATE_OBJECT_UUID = 'com.bbn.tc.schema.avro.cdm18.UUID'
    F_EVENT_PREDICATE_OBJECT_PATH = 'predicateObjectPath'
    F_EVENT_PREDICATE_OBJECT2 = 'predicateObject2'
    F_EVENT_PREDICATE_OBJECT2_PATH = 'predicateObject2Path'
    F_EVENT_PATH_STRING = 'string'
    F_EVENT_TIMESTAMP_NANOS = 'timestampNanos'
    F_EVENT_NAME = 'name'
    F_EVENT_NAME_STRING = 'string'
    F_EVENT_PARAMETERS = 'parameters'
    F_EVENT_PARAMETERS_ARRAY = 'array'
    F_EVENT_LOCATION = 'location'
    F_EVENT_SIZE = 'size'
    F_EVENT_PROGRAM_POINT = 'programPoint'
    F_EVENT_PROPERTIES = 'properties'
    F_EVENT_PROPERTIES_MAP = 'map'
    F_EVENT_MAP_HOST = 'host'

    # fd,return_value未必存在，可能时ret_fd1,ret_fd2,partial_path等等
    # F_EVENT_MAP_RETURN = 'return_value'
    # F_EVENT_MAP_FD = 'fd'
    F_EVENT_MAP_EXEC = 'exec'
    F_EVENT_MAP_PPID = 'ppid'



    #
    # 对于 Host 记录来说
    #

    F_HOST = 'com.bbn.tc.schema.avro.cdm18.Host'
    F_HOST_UUID = 'uuid'
    F_HOST_HOST_NAME = 'hostName'
    F_HOST_HOST_TYPE = 'hostType'
    F_HOST_INTERFACES = 'interfaces'
    F_INTERFACE_NAME = 'name'
    F_INTERFACE_MAC_ADDRESS = 'macAddress'
    F_INTERFACE_IP_ADDRESSES = 'ipAddresses'

    #
    # 对于 principal 记录来说
    #

    F_PRINCIPAL = 'com.bbn.tc.schema.avro.cdm18.Principal'
    F_PRINCIPAL_UUID = 'uuid'
    F_PRINCIPAL_TYPE = 'type'
    F_PRINCIPAL_HOST_ID = 'hostId'
    F_PRINCIPAL_USER_ID = 'userId'
    F_PRINCIPAL_USERNAME = 'username'
    F_PRINCIPAL_USERNAME_STRING = 'string'
    F_PRINCIPAL_GROUP_IDS = 'groupIds'
    # 此版本（CDM18）暂时无用
    F_PRINCIPAL_PROPERTIES = 'properties'
    F_PRINCIPAL_PROPERTIES_MAP = 'map'


    #
    # 对于 subject 记录来说
    #

    F_SUBJECT = 'com.bbn.tc.schema.avro.cdm18.Subject'
    F_SUBJECT_UUID = 'uuid'
    F_SUBJECT_TYPE = 'type'
    F_SUBJECT_CID = 'cid'
    F_SUBJECT_PARENT_SUBJECT = 'parentSubject'
    F_SUBJECT_PARENT_UUID = 'com.bbn.tc.schema.avro.cdm18.UUID'
    F_SUBJECT_HOST_ID = 'hostId'
    F_SUBJECT_LOCAL_PRINCIPAL = 'localPrincipal'
    F_SUBJECT_START_TIMESTAMP_NANOS = 'startTimestampNanos'
    F_SUBJECT_UNIT_ID = 'unitId'
    F_SUBJECT_ITERATION = 'iteration'
    F_SUBJECT_COUNT = 'count'
    F_SUBJECT_CMD_LINE = 'cmdLine'
    F_SUBJECT_PRIVILEGE_LEVEL = 'privilegeLevel'
    F_SUBJECT_IMPORTED_LIBRARIES = 'importedLibraries'
    F_SUBJECT_EXPORTED_LIBRARIES = 'exportedLibraries'
    F_SUBJECT_PROPERTIES = 'properties'
    F_SUBJECT_PROPERTIES_MAP = 'map'


    #
    # 对于不同类型的 object
    #

    # 通用object字段
    F_OBJ_BASE_OBJECT = 'baseObject'
    # baseObject.field
    F_OBJ_HOST_ID = 'hostId'
    F_OBJ_PERMISSION = 'permission'
    F_OBJ_EPOCH = 'epoch'
    F_OBJ_PROPERTIES = 'properties'
    F_OBJ_PROPERTIES_MAP = 'map'

    #
    # 有许多类型的源，如传感器。
    #

    F_SRCSINK = 'com.bbn.tc.schema.avro.cdm18.SrcSinkObject'
    F_SRCSINK_OBJECT_UUID = 'uuid'
    F_SRCSINK_OBJECT_BASE = 'baseObject'
    F_SRCSINK_OBJECT_HOST_ID = 'hostId'
    F_SRCSINK_OBJECT_PERMISSION = 'permission'
    F_SRCSINK_OBJECT_EPOCH = 'epoch'
    F_SRCSINK_OBJECT_PROPERTIES = 'properties'
    F_SRCSINK_OBJECT_PROPERTIES_MAP = 'map'
    F_SRCSINK_OBJECT_TYPE = 'type'
    F_SRCSINK_OBJECT_FILE_DESCRIPTOR = 'fileDescriptor'


    #
    # 对于unnamedpipe object
    #

    F_UNNAMEDPIPE = 'com.bbn.tc.schema.avro.cdm18.UnnamedPipeObject'

    F_UNNAMEDPIPE_UUID = 'uuid'
    F_UNNAMEDPIPE_BASE = 'baseObject'
    F_UNNAMEDPIPE_HOST_ID = 'hostId'
    F_UNNAMEDPIPE_PERMISSION = 'permission'
    F_UNNAMEDPIPE_EPOCH = 'epoch'
    F_UNNAMEDPIPE_PROPERTIES = 'properties'
    F_UNNAMEDPIPE_PROPERTIES_MAP = 'map'
    F_UNNAMEDPIPE_SOURCE_FD = 'sourceFileDescriptor'
    F_UNNAMEDPIPE_SINK_FD = 'sinkFileDescriptor'
    F_UNNAMEDPIPE_SOURCE_UUID = 'sourceUUID'
    F_UNNAMEDPIPE_SINK_UUID = 'sinkUUID'
    F_UUID_VAL = 'com.bbn.tc.schema.avro.cdm18.UUID'


    #
    # 对于netflow object
    #

    F_NETFLOW = 'com.bbn.tc.schema.avro.cdm18.NetFlowObject'
    F_NETFLOW_UUID = 'uuid'
    F_NETFLOW_BASE = 'baseObject'
    F_NETFLOW_HOST_ID = 'hostId'
    F_NETFLOW_PERMISSION = 'permission'
    F_NETFLOW_EPOCH = 'epoch'
    F_NETFLOW_PROPERTIES = 'properties'
    F_NETFLOW_PROPERTIES_MAP = 'map'
    F_NETFLOW_LOCAL_ADDRESS = 'localAddress'
    F_NETFLOW_LOCAL_PORT = 'localPort'
    F_NETFLOW_REMOTE_ADDRESS = 'remoteAddress'
    F_NETFLOW_REMOTE_PORT = 'remotePort'
    F_NETFLOW_IP_PROTOCOL = 'ipProtocol'
    F_NETFLOW_FILE_DESCRIPTOR = 'fileDescriptor'

    #
    # 对于 RegistryKeyObject
    #
    F_RegistryKeyObject = "com.bbn.tc.schema.avro.cdm18.RegistryKeyObject"
    F_RegistryKeyObject_UUID = 'uuid'
    F_RegistryKeyObject_BASE = 'baseObject'
    F_RegistryKeyObject_PERM = 'permission'
    F_RegistryKeyObject_EPOCH = 'epoch'
    F_RegistryKeyObject_PROP = 'properties'
    F_RegistryKeyObject_HOST_ID = 'hostId'
    F_RegistryKeyObject_KEY = 'key'
    F_RegistryKeyObject_V = "value"
    F_RegistryKeyObject_VALUE = 'com.bbn.tc.schema.avro.cdm18.Value'
    F_RegistryKeyObject_VALUE_DATATYPE = 'valueDataType'

        # '{"datum":{"com.bbn.tc.schema.avro.cdm18.RegistryKeyObject":' \
        # '{"uuid":"506BF92C-1FA2-4399-83C0-CFF9ACB933E3",' \
        # '"baseObject":{"hostId":"D2842312-8456-4C8E-ADD6-E2295D0939D3","permission":null,"epoch":null,"properties":null},' \
        # '"key":"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",' \
        # '"value":{"com.bbn.tc.schema.avro.cdm18.Value":{"size":-1,"type":"VALUE_TYPE_SRC",' \
        # '"valueDataType":"VALUE_DATA_TYPE_BYTE","isNull":true,"name":null,"runtimeDataType":null,' \
        # '"valueBytes":null,"provenance":null,"tag":null,"components":null}},"size":null}},' \
        # '"CDMVersion":"18","source":"SOURCE_WINDOWS_FIVEDIRECTIONS"}'


    #
    # 对于file object
    #


    F_FILE = 'com.bbn.tc.schema.avro.cdm18.FileObject'

    # 必备字段
    F_FILE_UUID = 'uuid'
    F_FILE_TYPE = 'type'

    # 非必备
    F_FILE_DESCRIPTOR = 'fileDescriptor'
    F_FILE_LOCAL_PRINCIPAL = 'localPrincipal'
    F_FILE_SIZE = 'size'
    F_FILE_PE_INFO = 'peInfo'
    F_FILE_HASHES = 'hashes'




class Annotations:
    '''
    定义溯源图节点/边的标注信息的键，
    '''

    #
    # 节点相关字段映射。
    #
    VERTEX_TYPE_KEY = 'type'
    VERTEX_UUID_KEY = 'uuid'

    #
    # 所有节点 的 type annotation键与取值的命名。
    #
    TYPE_SUBJECT_PROCESS = 'SUBJECT_PROCESS'

    TYPE_FILE_OBJECT_FILE = 'FILE_OBJECT_FILE'
    TYPE_FILE_OBJECT_BLOCK = 'FILE_OBJECT_BLOCK'
    TYPE_FILE_OBJECT_DIR = 'FILE_OBJECT_DIR'
    TYPE_FILE_OBJECT_CHAR = 'FILE_OBJECT_CHAR'
    TYPE_FILE_OBJECT_LINK = 'FILE_OBJECT_LINK'
    TYPE_FILE_OBJECT_NAMED_PIPE = 'FILE_OBJECT_NAMED_PIPE'
    TYPE_FILE_OBJECT_PEFILE = 'FILE_OBJECT_PEFILE'
    TYPE_FILE_OBJECT_UNIX_SOCKET = 'FILE_OBJECT_UNIX_SOCKET'
    TYPE_netflow = 'netflow'
    TYPE_unnamedpipe = 'unnamedpipe'


class NODE_INFO:
    # 统一节点类型
    MAP_TO_NODETPYE = {
        'SUBJECT_PROCESS': 'process',
        'netflow': 'netflow',
        'FILE_OBJECT_FILE': 'file',
        'FILE_OBJECT_DIR': 'dirctory',
        'FILE_OBJECT_BLOCK': 'blockdev',
        'FILE_OBJECT_CHAR': 'cahrdev',
        'FILE_OBJECT_LINK': 'linkdev',
        'unnamedpipe': 'unnamedpipe',
        'FILE_OBJECT_UNIX_SOCKET': 'unixsock',
        'FILE_OBJECT_NAMED_PIPE': 'namedpipe',
        'FILE_OBJECT_PEFILE': 'pefile',

    }


class EVENT_EDGE_INFO:
    '''记录常用的事件的值

    可以在这里进行边的分类，以支持后续工作的进行。

    '''

    # 进程信息流入 object
    SUB_TO_OBJ = ['EVENT_CLOSE','EVENT_FCNTL','EVENT_CONNECT','EVENT_WRITE','EVENT_OPEN','EVENT_MODIFY_FILE_ATTRIBUTES',\
                  'EVENT_FORK','EVENT_MODIFY_PROCESS','EVENT_LSEEK','EVENT_SENDTO',\
                  'EVENT_UNLINK','EVENT_SENDMSG','EVENT_TRUNCATE',
                  'EVENT_CREATE_OBJECT','EVENT_UPDATE','EVENT_CREATE_THREAD',
                  'EVENT_WRITE_SOCKET_PARAMS','EVENT_CLONE']

    # object信息流入进程
    OBJ_TO_SUB = ['EVENT_READ','EVENT_MMAP','EVENT_RECVMSG','EVENT_RECVFROM',\
                  'EVENT_LOADLIBRARY','EVENT_READ_SOCKET_PARAMS']


    # 两个object 都流向进程
    MultiOBJ_TO_SUB = ['EVENT_EXECUTE']


    ALL_TO_OBJ2 = ['EVENT_ADD_OBJECT_ATTRIBUTE','EVENT_RENAME']


    # 统一事件边， 记录事件类型 对应的 边的Operation
    MAP_TO_OP = {
        'EVENT_CLOSE': 'close',
        'EVENT_FCNTL': 'fcntl',
        'EVENT_CONNECT': 'connect',
        'EVENT_WRITE': 'write',
        'EVENT_OPEN': 'open',
        'EVENT_MODIFY_FILE_ATTRIBUTES': 'chmod',  # 或者其他修改文件属性的操作
        'EVENT_FORK': 'fork',
        'EVENT_MODIFY_PROCESS': 'modify_process',  # 这可能不是一个标准的系统调用，具体取决于上下文
        'EVENT_LSEEK': 'lseek',
        'EVENT_SENDTO': 'sendto',
        'EVENT_UNLINK': 'unlink',
        'EVENT_SENDMSG': 'sendmsg',
        'EVENT_TRUNCATE': 'truncate',
        'EVENT_CREATE_OBJECT': 'create',
        'EVENT_UPDATE': 'update',
        'EVENT_CREATE_THREAD': 'CREATE_THREAD',
        'EVENT_WRITE_SOCKET_PARAMS': 'send',
        'EVENT_CLONE': 'clone',

        'EVENT_READ': 'read',
        'EVENT_MMAP': 'mmap',
        'EVENT_RECVMSG': 'recvmsg',
        'EVENT_RECVFROM': 'recvfrom',
        'EVENT_LOADLIBRARY': 'loadlib',
        'EVENT_READ_SOCKET_PARAMS': 'recv',

        'EVENT_EXECUTE': 'exec',

        'EVENT_ADD_OBJECT_ATTRIBUTE': 'setxattr',  # 设置扩展属性
        'EVENT_RENAME': 'rename',  # 重命名文件或目录
    }

    accept = 'EVENT_ACCEPT'
    # EVENT_ADD_OBJECT_ATTRIBUTE
    # EVENT_BIND
    # EVENT_BLIND
    # EVENT_BOOT
    # EVENT_CHANGE_PRINCIPAL
    # EVENT_CHECK_FILE_ATTRIBUTES
    # EVENT_CLONE
    # EVENT_CLOSE
    # EVENT_CONNECT
    # EVENT_CREATE_OBJECT
    # EVENT_CREATE_THREAD
    # EVENT_DUP
    # EVENT_EXECUTE
    # EVENT_EXIT
    # EVENT_FLOWS_TO
    # EVENT_FCNTL
    # EVENT_FORK
    # EVENT_LINK
    # EVENT_LOADLIBRARY
    # EVENT_LOGCLEAR
    # EVENT_LOGIN
    # EVENT_LOGOUT
    # EVENT_LSEEK
    # EVENT_MMAP
    # EVENT_MODIFY_FILE_ATTRIBUTES
    # EVENT_MODIFY_PROCESS
    # EVENT_MOUNT
    # EVENT_MPROTECT
    open = 'EVENT_OPEN'
    # EVENT_OTHER
    # EVENT_READ
    # EVENT_READ_SOCKET_PARAMS
    # EVENT_RECVFROM
    # EVENT_RECVMSG
    # EVENT_RENAME
    # EVENT_SENDTO
    # EVENT_SENDMSG
    # EVENT_SERVICEINSTALL
    # EVENT_SHM
    # EVENT_SIGNAL
    # EVENT_STARTSERVICE
    # EVENT_TRUNCATE
    # EVENT_UMOUNT
    # EVENT_UNIT
    # EVENT_UNLINK
    # EVENT_UPDATE
    # EVENT_WAIT
    # EVENT_WRITE
    # EVENT_WRITE_SOCKET_PARAMS

#   Kairos使用时需要反转的边。
#     edge_reversed = [
#     "EVENT_ACCEPT",
#     "EVENT_RECVFROM",
#     "EVENT_RECVMSG"
# ]
